CVE-2025-5916: Libarchive Integer Overflow DoS Vulnerability

CVE-2025-5916 Overview

An integer overflow vulnerability has been identified in the libarchive library affecting the processing of Web Archive (WARC) files. This flaw occurs when libarchive handles a maliciously crafted WARC file that claims to have more than INT64_MAX - 4 content bytes. An attacker could exploit this vulnerability by providing a specially crafted WARC archive to applications that utilize libarchive for archive processing, potentially leading to memory corruption, unpredictable program behavior, or denial-of-service conditions.

Critical Impact

Applications processing untrusted WARC archives using vulnerable libarchive versions may experience memory corruption or denial-of-service when encountering maliciously crafted content length values.

Affected Products

• libarchive versions prior to 3.8.0
• Red Hat OpenShift Container Platform 4.0
• Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, and 10.0

Discovery Timeline

• June 9, 2025 - CVE-2025-5916 published to NVD
• December 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5916

Vulnerability Analysis

This vulnerability is classified as an Integer Overflow (CWE-190) within the WARC file format handler in libarchive. The WARC format is commonly used for web archiving and stores web content along with metadata. When libarchive parses a WARC file, it reads the declared content length from the archive header. If this value is maliciously set to exceed INT64_MAX - 4, the subsequent arithmetic operations on this value can overflow, wrapping around to a small or negative number.

The practical consequences of this integer overflow include potential buffer allocation miscalculations, leading to undersized memory allocations followed by out-of-bounds memory operations. Applications that process untrusted WARC archives are particularly vulnerable, as an attacker can craft an archive specifically designed to trigger this condition.

Root Cause

The root cause lies in insufficient bounds checking when handling the content-length field in WARC archive headers. The libarchive library failed to properly validate that the declared content size would not cause integer overflow when used in subsequent size calculations. This allows values approaching or exceeding INT64_MAX to trigger arithmetic overflow during internal processing operations.

Attack Vector

This vulnerability requires local access and user interaction to exploit. An attacker must craft a malicious WARC archive file and convince a user or automated system to process it using a vulnerable version of libarchive. The attack vector is local, meaning the attacker needs to deliver the malicious file to a system where it will be processed by an application using the vulnerable library.

Exploitation scenarios include:

• Delivering the malicious WARC file via email attachment
• Hosting the file on a web server for download
• Including it in archive repositories or backup systems
• Targeting automated archive processing pipelines

The vulnerability does not provide arbitrary code execution on its own but can corrupt memory states and cause denial-of-service conditions in affected applications.

Detection Methods for CVE-2025-5916

Indicators of Compromise

• Unusual crashes or segmentation faults in applications processing WARC files
• Memory-related errors in applications using libarchive for archive extraction
• Presence of WARC files with abnormally large declared content-length values exceeding normal file size limits
• Application logs showing unexpected behavior when processing web archive content

Detection Strategies

• Monitor for application crashes related to libarchive functions, particularly during WARC file processing
• Implement file inspection rules to flag WARC archives with suspicious content-length declarations
• Deploy endpoint detection to identify attempts to deliver oversized or malformed archive files
• Use SentinelOne's behavioral AI to detect anomalous memory access patterns during archive processing operations

Monitoring Recommendations

• Enable crash reporting and memory error logging for applications that process archive files
• Audit systems to identify vulnerable libarchive versions using package management queries
• Monitor file processing queues for WARC files with metadata inconsistencies
• Configure alerts for denial-of-service conditions in archive processing applications

How to Mitigate CVE-2025-5916

Immediate Actions Required

• Update libarchive to version 3.8.0 or later, which contains the fix for this vulnerability
• Restrict processing of WARC files from untrusted sources until patching is complete
• Review and update Red Hat Enterprise Linux systems using the vendor-provided security updates
• Audit applications that use libarchive to identify all potentially affected systems

Patch Information

The vulnerability has been addressed in libarchive version 3.8.0. The fix is available through the GitHub Pull Request #2568 and the v3.8.0 release. Red Hat has published a security advisory at their CVE-2025-5916 advisory page with additional tracking information available in Red Hat Bug Report #2370872.

For Red Hat Enterprise Linux and OpenShift Container Platform users, apply the appropriate vendor-supplied patches through yum update or dnf update commands once updates are available in your configured repositories.

Workarounds

• Disable or restrict WARC file processing in applications until patching can be completed
• Implement input validation to reject WARC files with content-length values exceeding reasonable thresholds
• Use application sandboxing to limit the impact of potential memory corruption
• Deploy network-level filtering to block delivery of suspicious archive files to critical systems

# Check installed libarchive version on Red Hat-based systems
rpm -qa | grep libarchive

# Update libarchive to patched version
sudo dnf update libarchive

# Verify the updated version
rpm -q libarchive